AFAIK, the compound file format identifier is D0 CF 11 E0 A1 B1 1A E1, which is located in the offset 0 of the header, which has a length of exactly 512 bytes.
However that is not enough to get the boundaries of the md5 hash of the password. After that I plan to find a preimage in order to recover the document.
Can someone help me please? Thank you in advance.
You link the word97 specification for your 2000 document. I'm not sure if the file format changed, but luckily the encryption is the same.
I don't think you need the md5 hash (if there is one), you just want to break the encryption. It looks like there are word 97/2000 decryptors on the web (paid or freeware). My basic google search indicated that it's easier to break the proprietary hash + encryption (partially rc4) than to brute-force the password.
I wasn't going to link the page, but it wasn't hard to find.
Initially a unicode password is taken and some bytes appended, this password is passed through a varient of the standard md5 hash algorithm.
The non standard hash is tricky, and Im far from sure what benefit over standard md5 the modified md5 hash has.
Not sure on how to break it, but must not be impossible since there are tools that do it.
I see in this post that a zip crack tool can be used: http://www.forensicswiki.org/wiki/Word_Document_%28DOC%29
